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What is claimed is: 

1 . A method for processing data communication passing through a node in a data 
network comprising: 

provisioning a service on the node, including configuring a detection point for the 
service; 

processing communication passing through the node, including monitoring the 
communication to identify matches to the configured detection point; and 

on identifying a match to the configured detection point, notifying service logic 
for the service of the detection point. 

2. The method of claim 1 wherein processing communication passing through the 
node includes processing data communication from a wireless network. 

3. The method of claim 2 wherein processing data communication from a wireless 
network includes processing data communication from a second-generation (2G) wireless 
telephone network. 

4. The method of claim 2 wherein processing data communication from a wireless 
network includes processing data communication from a third-generation (3G) wireless 
telephone network. 

5. The method of claim 2 wherein processing data communication from a wireless 
network includes processing data communication from a GPRS enabled wireless 
network. 

6. The method of claim 2 wherein processing data communication from a wireless 
network includes processing data communication from a wireless local area network 
(WLAN). 
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7. The method of claim 1 wherein processing communication passing through the 
node includes processing data conmiunication from a fixed network 

8. The method of claim 1 further comprising configuring a plurality of operators of 
services on the node. 

9. The method of claim 8 wherein configuring the operators includes configuring a 
virtual operator. 

10. The method of claim 8 wherein provisioning the service includes associating the 
service with one of the operators. 

1 1 . The method of claim 10 wherein the method further comprises providing data 
security between operators. 

12. The method of claim 1 wherein provisioning the service includes receiving a 
specification for configuring the detection point. 

13. The method of claim 1 wherein provisioning the service includes receiving 
configuration information for the service from a server external to the node. 

14. The method of claim 1 wherein the data communication includes packet data 
communication. 

15. The method of claim 14 wherein the packet data communication includes Internet 
Protocol (IP) data communication. 

16. The method of claim 15 wherein configuring the detection point includes 
specifying characteristics at one or more protocol layers. 

17. The method of claim 16 wherein specifying characteristics at one or more 
protocol layers includes specifying characteristics at a network layer. 
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18. The method of claim 16 wherein specifying characteristics at one or more 
protocol layers includes specifying characteristics at a transport layer. 

19. The method of claim 18 wherein specifying characteristics at a transport layer 
includes specifying characteristics related to a Transport Control Protocol (TCP). 

20. The method of claim 18 wherein specifying characteristics at a transport layer 
includes specifying characteristics related to a Universal Datagram Protocol (UDP). 

21. The method of claim 16 wherein specifying characteristics at one or more 
protocol layers includes specifying characteristics at an application layer. 

22. The method of claim 21 wherein specifying characteristics at an application layer 
includes specifying characteristics of a Hyper Text Transport Protocol (HTTP). 

23. The method of claim 21 wherein specifying characteristics at an application layer 
includes specifying characteristics of a RADIUS application protocol. 

24. The method of claim 21 wherein specifying characteristics at an application layer 
includes specifying characteristics of a Domain Name Service (DNS) protocol. 

25. The method of claim 16 wherein specifying characteristics at one or more 
protocol layers includes specifying characteristics at a plurality of protocol layers. 

26. The method of claim 16 wherein specifying characteristics at one or more 
protocol layers includes specifying a regular expression that identifies fields of data 
packets at one or more protocol layers. 

27. The method of claim 1 wherein the method further includes, on identifying a 
match to the detection point, processing the communication according to the service 
logic. 
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28. The method of claim 27 wherein the method further includes, on identifying a 
match to the detection point, suspending commimication associated with the matched 
detection point. 

29. The method of claim 27 wherein further processing the communication includes: 
receiving a specification for an event detection point from the service logic; 
configuring an event detection point; and 

monitoring the communication to identify matches to the configured event 
detection point. 

30. The method of claim 27 wherein further processing the communication includes 
redirecting the communication. 

3 1 . The method of claim 27 wherein further processing the communication includes 
passing the communication through a communication tunnel to a destination associated 
with the service. 

32. The method of claim 27 wherein further processing the communication includes 
filtering the communication. 

33. The method of claim 32 wherein the filtering includes blocking data packets 
according to an address identified in the packets. 

34. The method of claim 27 wherein further processing the communication includes 
applying a policy to the communication. 

35. The method of claim 34 wherein applying a policy to the communication includes 
applying a data rate policy. 

36. The method of claim 1 wherein provisioning the service includes conmiunication 
with a network management system. 
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37. The method of claim 1 wherein provisioning the service includes: 

identifying metering characteristics of communication for service interactions; 
and 

wherein processing communication passing through the node further includes 

detecting service interactions in the data communication each associated 
with the service and recording metering information for the detected 
service interactions. 

38. The method of claim 37 wherein recording metering information for the detected 
service interactions includes recording an amount of data transferred in the service 
interaction. 

39. The method of claim 38 wherein recording an amount of data transferred includes 
recording a number of packets. 

40. The method of claim 38 wherein recording an amount of data transferred includes 
recording a number proportional to a number of bytes. 

41. The method of claim 38 wherein recording an amount of data transferred includes 
recording an amount of data passed in one direction through the node. 

42. The method of claim 37 wherein recording metering information for the detected 
service interactions includes recording a rate of data transfer during the service 
interaction. 

43. The method of claim 37 wherein recording metering information includes 
recording metering information for an individual flow in a service interaction. 

44. The method of claim 37 wherein recording metering information includes 
recording metering information for a group of flows in a service interaction. 
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45. The method of claim 37 wherein recording metering information includes 
recording metering information for an entire service interaction. 

46. A method for processing data communication passing through a node in a data 
network comprising: 

processing communication sessions in the data communication passing through 
the node, including monitoring data packets for the communication 
sessions to identify matches to a configured detection point; 

on identifying a match to the configured detection point in one of the 

communication sessions, passing a request to extemal service logic 
identifying the detection point; and 

further processing the conmiunication session according to information received 
from the service logic in response to the passed request. 

47. The method of claim 46 wherein the further processing includes suspending the 
communication session, and then passing data for the communication session according 
to the received information. 

48. The method of claim 46 wherein the further processing includes redirecting the 
communication session according to the received information. 

49. A method for monitoring a service provided over data communication passing 
through a node in a data network comprising: 

provisioning the service including identifying characteristics of communication 
for service interaction; 

detecting service interactions in the data communication each associated with a 
particular user of the service; and 

providing information related to the detected service interactions. 

50. The method of claim 49 wherein detecting service interactions includes matching 
the data communication to detection points. 
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51. The method of claim 50 wherein the detection points include characteristics at 
multiple protocol layers. 

52. The method of claim 49 wherein providing the information includes exporting the 
information to an external system. 

53. The method of claim 49 wherein the information related to the detected sessions 
relates to a group of subscribers. 

54. The method of claim 49 wherein the information related to the detected sessions 
relates to a particular service. 

55. The method of claim 49 wherein the information related to the detected sessions 
relates to an operator. 

56. The method of claim 49 wherein the information related to the detected sessions 
includes a detail record related to a session. 

57. The method of claim 56 wherein the detail record related to the session includes a 
detail record related to only a portion of the session. 

58. The method of claim 49 wherein the information is related to the detected 
sessions relates to a time interval of operation. 

59. A method for processing packet data communication between mobile stations on 
a wireless telephone network and service providers on a fixed network comprising: 

provisioning a service on a node coupling the wireless network and the fixed 
network, including configuring service logic for the service; 

processing packet data communication passing between the wireless telephone 

network and the fixed network through the node, including monitoring the 
communication to identify communication sessions associated with the 
provisioned service; 
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matching detection points in the identified communication sessions; and 
executing service logic in response to matching of the detection points. 

60. The method of claim 59 wherein executing service logic include communicating 
with an external service platform, and processing the packet data communication includes 
processing the communication according to information received from the external 
service platform. 

61 . A communication node comprising: 

means for provisioning a service on the node, including means for configuring a 
detection point for the service; 

means for processing communication passing through the node, including means 
for monitoring the communication to identify matches to the configured 
detection point; and 

means for notifying service logic for the service of the detection point when a 
match to the configured detection point is identified. 

62. A communication node comprising: 

a service manager configured to accept provisioning information for services; 

a database coupled to the service manager, including storage for storing the 
accepted provisioning information; 

circuitry for passing packet data communication through the device and for 
detecting configurable events in the data communication; and 

a service execution engine programmed to communicate with the service manager 
and to receive notifications of the detected events for the circuitry for 
passing data. 

63. The communication node of claim 62 wherein the database further comprises 
storage for detail records, and wherein the service execution engine is further 
programmed to generate detail records in response to the received notifications. 
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